Buggy code:
@ WebServlet ( urlPatterns = SessionOperationServlet . SERVLET_PATH ) public class SessionOperationServlet extends HttpServlet { private static final long serialVersionUID = - 1769104491085299700L ; private static final String SERVLET_NAME = "listener" ; static final String SERVLET_PATH = "//" + ( SessionOperationServlet . SERVLET_NAME ) ; private static final String OPERATION = "operation" ; private static final String INVALIDATE = "invalidate" ; private static final String GET = "get" ; private static final String SET = "set" ; private static final String REMOVE = "remove" ; private static final String TIMEOUT = "timeout" ; private static final String NAME = "name" ; private static final String VALUE = "value" ; public static final String RESULT = "result" ; public static final String SESSION_ID = "jsessionid" ; public static final String CREATED_SESSIONS = "created" ; public static final String DESTROYED_SESSIONS = "destroyed" ; public static final String ADDED_ATTRIBUTES = "added" ; public static final String REPLACED_ATTRIBUTES = "replaced" ; public static final String REMOVED_ATTRIBUTES = "removed" ; public static final String BOUND_ATTRIBUTES = "bound" ; public static final String UNBOUND_ATTRIBUTES = "unbound" ; public static URI createGetURI ( URL baseURL , String name ) throws URISyntaxException { } public static URI createGetURI ( URL baseURL , String name , String value ) throws URISyntaxException { } public static URI createSetURI ( URL baseURL , String name , String ... values ) throws URISyntaxException { } public static URI createRemoveURI ( URL baseURL , String name ) throws URISyntaxException { } public static URI createInvalidateURI ( URL baseURL ) throws URISyntaxException { } public static URI createTimeoutURI ( URL baseURL , int timeout ) throws URISyntaxException { } private static StringBuilder buildURI ( String operation ) { } private static StringBuilder appendParameter ( StringBuilder builder , String parameter , String value ) { } @ Override protected void doGet ( HttpServletRequest req , HttpServletResponse resp ) throws ServletException { String operation = SessionOperationServlet . getRequiredParameter ( req , SessionOperationServlet . OPERATION ) ; HttpSession session = req . getSession ( true ) ; resp . addHeader ( SessionOperationServlet . SESSION_ID , session . getId ( ) ) ; System . out . println ( String . format ( "%s?%s;jsessionid=%s" , req . getRequestURL ( ) , req . getQueryString ( ) , session . getId ( ) ) ) ; if ( operation . equals ( SessionOperationServlet . SET ) ) { String name = SessionOperationServlet . getRequiredParameter ( req , SessionOperationServlet . NAME ) ; String [ ] values = req . getParameterValues ( SessionOperationServlet . VALUE ) ; if ( values != null ) { <START_BUG> SessionOperationServlet . SessionAttributeValue value = ( values != null ) ? new SessionOperationServlet . SessionAttributeValue ( values [ 0 ] ) : null ; <END_BUG> session . setAttribute ( name , value ) ; for ( int i = 1 ; i < ( values . length ) ; ++ i ) { value . setValue ( values [ i ] ) ; } } else { session . setAttribute ( name , null ) ; } } else if ( operation . equals ( SessionOperationServlet . REMOVE ) ) { String name = SessionOperationServlet . getRequiredParameter ( req , SessionOperationServlet . NAME ) ; session . removeAttribute ( name ) ; } else if ( operation . equals ( SessionOperationServlet . INVALIDATE ) ) { session . invalidate ( ) ; } else if ( operation . equals ( SessionOperationServlet . GET ) ) { String name = SessionOperationServlet . getRequiredParameter ( req , SessionOperationServlet . NAME ) ; SessionOperationServlet . SessionAttributeValue value = ( ( SessionOperationServlet . SessionAttributeValue ) ( session . getAttribute ( name ) ) ) ; if ( value != null ) { resp . setHeader ( SessionOperationServlet . RESULT , value . getValue ( ) ) ; String newValue = req . getParameter ( SessionOperationServlet . VALUE ) ; if ( newValue != null ) { value . setValue ( newValue ) ; } } } else if ( operation . equals ( SessionOperationServlet . TIMEOUT ) ) { String timeout = SessionOperationServlet . getRequiredParameter ( req , SessionOperationServlet . TIMEOUT ) ; session . setMaxInactiveInterval ( Integer . parseInt ( timeout ) ) ; } else { throw new ServletException ( ( "Unrecognized<seq2seq4repair_space>operation:<seq2seq4repair_space>" + operation ) ) ; } SessionOperationServlet . setHeader ( resp , SessionOperationServlet . CREATED_SESSIONS , createdSessions ) ; SessionOperationServlet . setHeader ( resp , SessionOperationServlet . DESTROYED_SESSIONS , destroyedSessions ) ; SessionOperationServlet . setHeader ( resp , SessionOperationServlet . ADDED_ATTRIBUTES , addedAttributes . get ( session . getId ( ) ) ) ; SessionOperationServlet . setHeader ( resp , SessionOperationServlet . REPLACED_ATTRIBUTES , replacedAttributes . get ( session . getId ( ) ) ) ; SessionOperationServlet . setHeader ( resp , SessionOperationServlet . REMOVED_ATTRIBUTES , removedAttributes . get ( session . getId ( ) ) ) ; SessionOperationServlet . setHeader ( resp , SessionOperationServlet . BOUND_ATTRIBUTES , SessionOperationServlet . SessionAttributeValue . boundAttributes ) ; SessionOperationServlet . setHeader ( resp , SessionOperationServlet . UNBOUND_ATTRIBUTES , SessionOperationServlet . SessionAttributeValue . unboundAttributes ) ; } private static void setHeader ( HttpServletResponse response , String header , BlockingQueue < String > queue ) { } private static String getRequiredParameter ( HttpServletRequest req , String name ) throws ServletException { } public static class SessionAttributeValue implements Serializable , HttpSessionBindingListener { private static final long serialVersionUID = - 8824497321979784527L ; static final BlockingQueue < String > boundAttributes = new LinkedBlockingQueue < > ( ) ; static final BlockingQueue < String > unboundAttributes = new LinkedBlockingQueue < > ( ) ; private volatile String value ; public SessionAttributeValue ( String value ) { } public String getValue ( ) { } public void setValue ( String value ) { } @ Override public void valueBound ( HttpSessionBindingEvent event ) { } @ Override public void valueUnbound ( HttpSessionBindingEvent event ) { } } }

Fix:
SessionOperationServlet . SessionAttributeValue value = new SessionOperationServlet . SessionAttributeValue ( values [ 0 ] ) ;